Analysis
-
max time kernel
154s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 20:36
Static task
static1
Behavioral task
behavioral1
Sample
538837d458c47ec4f535032e653d57402b19b750f70bc958f6f051596b81979c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
538837d458c47ec4f535032e653d57402b19b750f70bc958f6f051596b81979c.exe
Resource
win10v2004-20220812-en
General
-
Target
538837d458c47ec4f535032e653d57402b19b750f70bc958f6f051596b81979c.exe
-
Size
159KB
-
MD5
064ebe71f38e74f01f760c927a820e00
-
SHA1
665753880b59faab50ea372cdc53b703148eb69e
-
SHA256
538837d458c47ec4f535032e653d57402b19b750f70bc958f6f051596b81979c
-
SHA512
fa8c85778e5b10eaf45aa8ad9dfb887f3d9b9132f37091fe209f86f64436a30accbba1e5378cf41db08c3d8bbd9ead697b161b7b38472a27d378256b0bd05897
-
SSDEEP
3072:7hlW2hYZVSmFm7TfRCcdXHwjNIO2BQuKZzBw26Y:7ht+VrzcNHeIr41w8
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B39A7A81-7132-4D67-B189-AB929DB00154}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7D792538-109A-45DF-88FE-AA0BD1B9B750}.catalogItem svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4580 4348 WerFault.exe 538837d458c47ec4f535032e653d57402b19b750f70bc958f6f051596b81979c.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\538837d458c47ec4f535032e653d57402b19b750f70bc958f6f051596b81979c.exe"C:\Users\Admin\AppData\Local\Temp\538837d458c47ec4f535032e653d57402b19b750f70bc958f6f051596b81979c.exe"1⤵PID:4348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 2522⤵
- Program crash
PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4348 -ip 43481⤵PID:1008
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3876